This is the evidence behind Register to Vote, Reported to X, graded. It shows the method, the data observed leaving the page, every claim marked for how well it is supported, and, deliberately, what the evidence cannot establish. Originals are preserved; a SHA-256 manifest of all 174 captured files backs each item.
Nothing here is inferred quietly. Where a claim rests on outside reporting, on an archive, or on reasoning rather than a capture, it says so.
Step 3. Destination domains, what each received, event order. Sentinel values/hashes/sync-IDs redacted. Source: matrix/out/vendorflows.json + FIELDMATRIX + hashproof (see manifest)._
| vendor | hosts | request fired | sentinel identifier received | nature |
|---|---|---|---|---|
| VoteSafe-1p | votesafe.org | yes | none observed | page/identifier events |
| Cloudflare | challenges.cloudflare.com, hagen.challenges.cloudflare.com, static.cloudflareinsights.com | yes | none observed | page/identifier events |
| Sentry | o4507934505369600.ingest.us.sentry.io | yes | none observed | page/identifier events |
| ad.doubleclick.net, cm.g.doubleclick.net, googleads.g.doubleclick.net, stats.g.doubleclick.net, www.googletagmanager.com | yes | none observed | page/identifier events | |
| X/Twitter | analytics.twitter.com, static.ads-twitter.com, t.co | yes | email(sha256/sha256_raw); phone(sha256) | DIRECT PII (hashed) |
| Meta/Facebook | connect.facebook.net, www.facebook.com | yes | none observed | page/identifier events |
| TheTradeDesk | insight.adsrvr.org, js.adsrvr.org, match.adsrvr.org | yes | none observed | cookie-sync only |
| Incrementdata | track.incrementdata.com | yes | none observed | page/identifier events |
| IndexExchange/Casale | dsum-sec.casalemedia.com | yes | none observed | cookie-sync only |
| AWS-collector | tw-0fde0867b14c4d8e9131519b5349f6f2.ecs.us-west-2.on.aws | yes | none observed | page/identifier events |
| Xandr/AppNexus | ib.adnxs.com | yes | none observed | cookie-sync only |
| PubMatic | simage2.pubmatic.com | yes | none observed | cookie-sync only |
Inputs were fabricated (sentinel-example.org / example.com, test phones); no real person. Hashes and third-party sync UUIDs redacted as working-report hygiene.
Step 4. Built 2026-11-01 from the preserved evidence (see MANIFEST-sha256.txt). Grading: OBSERVED = in our own captures. SOURCED = external reporting / officials / public records. INFERRED = reasoned from observed+sourced, not itself captured. UNRESOLVED = cannot be established by any evidence we have or can lawfully get.
| # | Claim | Grade | Evidence / source |
|---|---|---|---|
| 1 | /register sends the email as SHA-256 to X (analytics.twitter.com, t.co) on submit-click | OBSERVED | hash_proof.json; 4 reproductions (leak_run1/2, accept_run1/2); digest recomputed independently |
| 2 | /register sends the phone as SHA-256 (E.164) to X on submit-click | OBSERVED | same four captures; FIELD_MATRIX |
| 3 | Citizenship button text ("YES, I AM A U.S. CITIZEN") forwarded to X via GTM autobuttonclick | OBSERVED (verify dest) | autobuttonclick value present in leak_run1/2, accept_run1/2 โ RE-VERIFY the receiving endpoint is an X domain before relying in print |
| 4 | Google receives step events (ep.step=citizenship, party) | OBSERVED | capture raw |
| 5 | Name, DOB, home address NOT seen leaving to any third party | OBSERVED (negative) | FIELD_MATRIX; absence in captures = not proof of non-transmission |
| 6 | Hashing is a join key, not anonymization; X can match a hash to its own users | SOURCED/technical | property of SHA-256 + platform advanced-matching docs; true in general |
| 7 | X actually resolved the hashes, matched identities, built audiences, or targeted anyone | UNRESOLVED | happens inside X; not browser-observable; FEC shows no custom-audience buy |
| 8 | VoteSafe is operated by America PAC (Elon Musk's super PAC) | SOURCED | Sinclair/mynbc15; Colorado + Washington election officials. NOT from our captures |
| 9 | GTM container GTM-TKMSVPPQ present on /register in 2024 | SOURCED | Internet Archive (Wayback) |
| 9b | Data flowed to X in 2024 specifically | INFERRED | container present 2024 (archive) + behavior proven 2026; no 2024 network capture |
| 10 | VoteSafe's privacy policy permits selling data to "business partners," incl. where/whether you are registered and "how you submit your vote," and drawing "inferences... a profile" | OBSERVED (policy doc) | matrix/policy/privacy-policy.html โ verbatim strings present in our captured copy |
| 11 | "...how you VOTED / how you CAST your ballot" (candidate choice) | UNRESOLVED / OVERREACH | policy text is "how you SUBMIT your vote" (method), not vote choice โ see ARTICLE_AUDIT flag A |
| 12 | America PAC collected data but failed to register people; states investigated (NC, MI; GA, WI affected) | SOURCED | CNBC/NBC/Salon/Alabama Reflector reporting; NOT in our captures; appears in LinkedIn post + summaries, NOT in the published essay |
| 13 | "Closed loop": PAC operates the site, X receives the data, Musk funds the PAC and owns X | INFERRED (framing) | components are SOURCED (8) + OBSERVED (1,2); the loop's significance is interpretation, not a captured fact. No motive/causation claimed |
| 14 | America PAC = FEC C00825851; spend went to data/research/canvassing vendors, not visible platform ad-buys | SOURCED | open.fec.gov schedule_b pull |
Step 6.
Not pursued, by rule: no intrusion into X / America PAC systems, no unlawful access, no soliciting unlawfully-obtained material. The open questions are answered through records, regulators, and courts, or they stay open.
Step 7. Unpublished. Built 2026-11-01. Evidence integrity: see MANIFEST-sha256.txt (174 files + votesafe.tar). Observations dated as tested 2026-09-21; capture dates are the evidence files' own, not asserted beyond them.
A real headless browser loaded votesafe.org/register from a US IP, filled every field with fabricated, uniquely-tokened sentinel values (no real person), and recorded all outbound requests. Entered values were matched against plaintext and SHA-256/SHA-1/MD5 (raw and normalized). The harness only observes requests and fills fields as a user would; it does not originate the third-party beacons. Six US + two EU controlled sessions; the X finding reproduced in four.
On submit-click, the site's X/Twitter pixel fires a "register-submit" conversion beacon as an outbound GET to analytics.twitter.com and t.co carrying:
email_address = [hash redacted]phone_number = [hash redacted]Recomputed independently; exact digests present; sentinel emails unique per run (excludes misattribution). Citizenship-step button text is forwarded via a GTM autobuttonclick handler (endpoint to be re-verified as an X domain). Name, DOB, and home address were NOT observed leaving to any third party. Other vendors (Meta, Google, Trade Desk, Casale, BidSwitch, AppNexus, PubMatic, Incrementdata, an AWS collector, Sentry) fired requests / cookie-syncs but carried no sentinel field value.
The site's captured privacy policy (matrix/policy/privacy-policy.html) states it may "sell this information to our business partners," and that covered information may include "where you are registered to vote, whether you are registered to vote and how you submit your vote," plus "inferences... a profile." This is the policy's stated permission, not evidence a sale occurred.
Whether X retained, resolved, matched, or targeted from the hashes; any sale; candidate choice; registration success. See LIMITATIONSANDLAWFUL_AVENUES.md.
Operation attributed to America PAC (Musk's super PAC) by Sinclair reporting and Colorado/Washington election officials โ not derived from these captures.
Evidence preserved and hashed 1 November 2026; observations as tested 21 September 2026. Full request captures and the SHA-256 manifest are available on request. A litigation-hold request is held with counsel and is not published here.